Technical Field of the Invention
The present invention relates generally to media processing systems and, more particularly, to establishing and maintaining secure and unsecure media pathways in a device such as a set top box having untrusted components integrated with a secure operating system environment.
Description of Related Art
Attempts to accommodate relatively untrusted software applications or frameworks in certain types of devices may complicate applicable certification processes that are performed in accordance with one or more industry defined certification standards or testing procedures. For example, vendor certification of many set top boxes used by cable operators is conducted via rigid certification processes that test interoperability and security compliance for devices that implement specifications such as DOCSIS®, PacketCable™, CableHome™, and OpenCable™. Successful certification of such devices typically requires full end-to-end security. Likewise, digital rights management (DRM) and other technologies implemented in a particular device or component (such as a system-on-a-chip) may require distinct certification processes which do not allow certain interactions with an unsecured operating system (OS) environment or software framework. When implemented in a cable set top box, cable modem, media terminal adapter or like cable service device, certain specifications may require that a digital certificate be embedded in the device at the time of manufacture. Such certificates underpin a number of security features including device authentication and content integrity. By way of example, a digital certificate embedded in such devices helps prevent pirating of services by allowing a content provider or service operator to authenticate a device requesting services.
In general, any unsecured portions of a media pathway in a set top box or like device, if not isolated, will cause the certification of such pathway to fail. Most conventional set top boxes are designed to provide a single secure and certified pathway through the various elements or components of the device. In some recent multi-processor set top boxes, a conventional certified pathway is separated from untrusted components by creating a hardware boundary between the two. In particular, a first processing module is utilized to provide secure functionality (e.g., decoding operations), while a separate processing module with a lower security level is used to support an untrusted framework.
As is known, a software framework may provide application programming interface functionality and services that are not offered by an underlying operating system, and may thereby offer a level of platform independence in certain implementations. Frameworks are often designed to be a reusable and adaptable software system or subsystem. For example, ANDROID™ (“Android”) has become one of the fastest-growing operating systems/frameworks for mobile devices. Android, which builds on contributions from the open-source Linux community, provides development tools and reusable components for building applications that can be deployed across many different types of devices, such as a smartphone or tablet device.
A typical Android framework is a “multi-user” Linux-based system in which each Android application is a different “user” having code that runs in general isolation from other applications. Such process isolation (or application “sandbox”) provides a certain level of security. However, various components, processes, threads, etc. used by an application may not entail sufficient protection when integrated in a set top box-type device, resulting in Android being considered an “untrusted” framework when used in such devices. For example, an application that visits an arbitrary web page or receives code from an unverified third party may result in untrusted JavaScript code being executed on a set top box, possibly with elevated privileges. Such code might exploit weakness in other code (e.g., browser code) and receive unauthorized access to file systems, etc., thereby compromising the security of a device, exposing protected data or introducing system instability.
As indicated above, the processing unit of some devices may have multiple processors or processing cores in order to provide higher performance and/or multi-tasking capabilities. In some of these multi-processor systems, when multiple applications or programs are running, access control is typically needed to separate the functionality of the applications running on multiple processors. Separation or segregation of different applications and/or tasks running on different processors helps to ensure that one application does not interfere with the execution of another. Likewise data assigned to one processor should not be accessed by another processor, unless that data is shared between the two processors. Such separation is typically handled through use of virtual memory, with each process having a unique view of memory that is not accessible from outside processes. Hardware access can be handled through a kernel or device driver interface, which provides some level of security. Even in a multi-processor system in which one processor environment provides trusted or secure operations while another operates in an unsecure or restricted environment, however, there can be a substantial possibility of an incursion from the unsecure zone into the secure zone when the operating system is managing the separation.
For example, in a set top box that allows a user to receive television signals and also allows the user to access the Internet, the secure environment may run applications (including a secure set top box application) pertaining to the reception, decryption and display of certain channels or content provided by a cable or satellite provider or other service operator. The unsecure environment in the set top box may execute applications, such as Android-based applications, that allow a user to access the Internet for web browsing, gaming, etc. In this example, the content provider would generally not want the user or anyone else to access the applications pertaining to broadcast or premium channels. However, if there is commonality in software that controls the accesses to both environments, such as running the same operating system to manage accesses in both environments, then there may be a heightened risk of access violations. Such violations, whether intentional or non-intentional, could result in an unsecure breach into the secure applications of the set top box, such as a web-originated intrusion into protected television channels.
Accordingly, there is a need to obtain an efficient way to integrate untrusted frameworks and applications with a secure operating system environment such as that of a set top box device, while also maintaining compliance and flexibility with respect to applicable certification procedures and security measures.